CVE-2026-86429 in commonmark
Summary
by MITRE • 09/07/2026
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
The league/commonmark library, specifically versions ranging from 1.5.0 up to but not including 2.9.1, is susceptible to a quadratic parsing complexity vulnerability that affects system stability and resource availability. This flaw is intrinsic to the SmartPunctExtension and AttributesExtension modules within the library. It is important to note that these extensions are not enabled by default in standard configurations such as CommonMark or GitHub-Flavored Markdown converters; they must be explicitly registered on the Environment object for the vulnerability to be exploitable. Consequently, applications relying solely on default parsing settings remain unaffected, but any implementation that actively enables these specific features introduces a significant risk surface for denial of service attacks.
The technical nature of this flaw lies in the algorithmic inefficiency used during the parsing process when handling certain malformed or specially crafted Markdown inputs. When an unauthenticated attacker submits documents containing patterns such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes, the parser enters a state where its processing time increases quadratically relative to the input size. This means that rather than linearly scaling resources with document length, the CPU consumption spikes disproportionately even for relatively small inputs. The underlying issue stems from how these extensions handle edge cases in syntax parsing without adequate bounds checking or optimization strategies to prevent exponential backtracking or redundant state evaluations.
From an operational perspective, this vulnerability facilitates a remote denial of service attack vector. An attacker can exploit this by sending maliciously crafted HTTP requests containing the problematic Markdown snippets to any endpoint that processes user-generated content using the affected library versions with the vulnerable extensions enabled. The resulting disproportionate CPU consumption can lead to server resource exhaustion, causing legitimate users to experience timeouts or complete service unavailability. This type of attack is particularly dangerous in high-traffic environments where automated scanners might repeatedly probe for such weaknesses, potentially leading to sustained degradation of service availability without requiring any form of authentication or privilege escalation.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to properly limit the resources consumed by a single user input. Furthermore, it maps to MITRE ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources in excess of what is normal or authorized for legitimate purposes. The exploitation does not involve data exfiltration or code execution but focuses purely on disrupting service availability through computational exhaustion.
To mitigate this risk, organizations must immediately upgrade the league/commonmark library to version 2.9.1 or later, where these parsing inefficiencies have been addressed and optimized. For applications that cannot update immediately due to compatibility constraints, it is critical to audit configurations to ensure that SmartPunctExtension and AttributesExtension are not explicitly registered on the Environment unless absolutely necessary. If these extensions are required for specific functionality, implementing input size limits or timeout mechanisms at the application layer can help mitigate the impact of such attacks by terminating long-running parsing operations before they consume excessive resources. Regular security audits should also include testing for quadratic complexity vulnerabilities in text processing libraries to ensure robust defense against resource exhaustion attempts.